Sealing Quantum Message By Quantum Code 
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Quantum error correcting code is a useful tool to combat noise in quantum computation. It 
is also an important ingredient in a number of unconditionally secure quantum key distribution 
schemes. Here, I am going to show that quantum code can also be used to seal a quantum message. 
Specifically, every one can still read the content of the sealed quantum message. But, any such 
attempt can be detected by an authorized verifier with an exponentially close to one probability. 

PACS numbers: 03.67.Dd, 03.67.Pp, 89.20.Ff, 89.70.+C 



Introduction — We sometimes put an important docu- 
ment, such as a will, in an envelop sealed with molten wax 
so that others can open it only by breaking the wax. The 
sealed envelop, therefore, acts like a witness of whether 
the document has been open. 

Clearly, it is meaningful and useful to extend the con- 
cept of physical wax seal to the digital world. Yet, no 
digital sealing scheme is unconditionally secure in the 
classical digital world as one can, in principle, copy all 
the bits without being caught. 

Recently, Bechmann-Pasquinucci examined the possi- 
bility of sealing a classical digital signal using quantum 
mechanics. Specifically, he proposed a way to represent 
one bit of classical signal by three qubits out of which 
one of them is erroneous. Using single qubit measure- 
ment along the standard basis plus the classical [3, 1,3] 2 
majority vote code, everyone can obtain the original clas- 
sical bit with certainty. And at the same time, an autho- 
rized verifier, who knows some extra information on the 
erroneous qubit, is able to check if someone has extracted 
the encoded classical bit with non-negligible probability 

Q 

Nevertheless, Bechmann-Pasquinucci's scheme is far 
from a good quantum seal as there is a non-negligible 
chance of knowing the original bit without being caught.^ 
For instance, one may randomly pick one of the qubits 
and measure its state along the standard basis. In 
this way, the chance of knowing the original classi- 
cal bit correctly without being caught equals 2/3-1- 
(l/3)(l/2)(l/2) = 0.75. Furthermore, it is not clear how 
to seal quantum information in Bechmann-Pasquinucci's 
scheme. 

In this Letter, I report a quantum seal scheme using 
quantum error correcting code. This scheme can seal 
both classical and quantum signals. I also prove that 



^ Actually, Bechmann-Pasquinucci was more interested in the se- 
curity of obtaining the entire classical bit string by which each 
bit is encoded using his scheme. However, this security require- 
ment is too relaxed as the ability to know just a single bit of 
an important document without being caught may already have 
serious sequences. 



any person other than an authorized verifier has an ex- 
ponentially small chance of knowing the original signal 
without being caught. This remains true even when the 
person has unlimited computational power. 

The Quantum Seal — Let {-ip) be the state of a qubit 
that Alice wants to make public so that anyone may use 
it. (Note that because of the no cloning theorem, Al- 
ice may know nothing about the state To seal the 
state, Alice publicly announces a [[n, l,d]]2 Calderbank- 
Shor-Steane (CSS) code 0, S with d > O.lln and 
uses it to encode jV')- (The existence of such a code 
is guaranteed by a theorem of Gottesman in Ref. 0|.) 
The encoded state is denoted by Alice further 
chooses a [[n',l,3]]2 stabilizer code and uses it to en- 
code t = [{d— 1)/2J copies of |0). Such an encoded state 
is denoted by |0)®,*. As depicted in Fig. ^ Afice ran- 
domly selects {n — t) qubits from those used to represent 
\ip)-L and t qubits each from a separate copy of |0)l'. She 
makes these n selected qubits publicly accessible. At the 
same time, she keeps all the remaining n't qubits (which 
consist of the t qubits used to encoded and the re- 
maining (n' — l)t qubits used to encode t copies of |0)) 
in a secure place. This marks the end of the quantum 
sealing phase. Clearly, the security of the quantum seal 
originates from the secrecy of which of the (n—t) publicly 
available qubits are used to encode \tp). 

To open the seal and obtain the original quantum state. 
Bob simply applies the standard quantum error correc- 
tion procedure for the [[n, 1, c?]]2 CSS code to the n pub- 
licly accessible qubits. This method works because there 
are only t out of the n qubits at unknown locations that 
are not used to encode \tp). 

To check if the seal is opened, we need an authorized 
verifier who has access to the remaining n't qubits and 
knows the locations of the t publicly accessible qubits 
that are not used to encode \ip). Clearly, if no one has 
touched the n publicly available qubits, the {n + n't) 
qubits accessible by the verifier should be in the state 
h/')L O |0)l'*- Therefore, the verifier accepts the seal as 
unbroken only if the [[n, 1, d]]2 and the [[n' , 1, 3]]2 stabi- 
lizer code error syndrome measurements reveal that all 
the {n + n't) qubits are error-free. 

Security Of The Quantum Seal — Now, I am going to 
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Publicly Accessible Verifier's Lab 

FIG. 1; As an example, I schematically represent the quan- 
tum seal using the [[7, 1, 3]]2 CSS code and the [[5, 1, 3]]2 per- 
fect code in this figure. Each dot represents a qubit and the 
solid line joining the dots represents the entangled qubits in 
[[7, 1, 3]]2 or [5, 1, 3]]2 code. Qubits in the left dashed box are 
publicly accessible while those in the right dashed box are 
available only to an authorized verifier. 



show that the above quantum sealing scheme is uncondi- 
tionally secure. Specifically, for any security parameters 
(ep,e/) , there exists a quantum sealing scheme using a 
sufficiently long quantum codeword length n such that 
whenever Bob (who is not an verifier) applies a cheating 
strategy whose probability of success is at least ep, his in- 
formation on the state jV') is less than e/. Moreover, this 
is true even if he has unlimited computational power. 

I prove the unconditional security of the above scheme 
by reduction. First, I consider a revised quantum sealing 
scheme and show that it is as secure as the original one 
introduced above. The encoding procedure of the revised 
scheme is the same as the original one. But in the verifi- 
cation procedure of the revised scheme, the verifier also 
measures the encoded spin flip operator for the [[n, 1, d]]2 
and the [[n', 1, 3]]2 stabilizer codes in addition to the er- 
ror syndrome measurement. Yet, the verifier accepts the 
quantum seal as unbroken based only on the result of the 
error syndrome measurement in exactly the same way as 
in the original scheme. Note that the encoded spin flip 
operations commute with the stabilizer and the accep- 
tance criterion of the revised scheme does not depend on 
the result of the encoded spin flip measurement. Conse- 
quently, any cheating strategy will have an equal chance 
to pass through the verification test and will reveal an 
equal amount of information on the sealed quantum state 
when applied to the original and the revised schemes. In 
this respect, the two schemes are equally secure; and it 
suffices to prove the security of the revised scheme. 

Second, I reduce every quantum cheating strategy for 
the revised scheme to a corresponding classical cheat- 
ing strategy. Observe that there are {n + n't) indepen- 
dent stabilizers and encoded spin flip operations, all the 
[n + n't) qubits are measured in the revised scheme dur- 
ing the verification phase. Hence, following the argument 
of Lo and Chau in Ref. , any quantum cheating strat- 
egy for the revised scheme can be reduced to a classical 



probabilistic one. More precisely, all cheating strategies 
can be generated by the classical deterministic strategies 
0"=! acting on the n qubits accessible by Bob, where 
Si e {/, a^, cFy,az}. 

Third, I analyze what type of classical cheating strat- 
egy reveals the information on the locations of the t pub- 
licly accessible qubits that are not used to encode the 
sealed state lip). As the t qubits taken from jO)®* are 
unentangled with the {n — t) qubits taken from 
the entropy and hence the information obtained from the 
measurement of those qubits coming from and |0)®,* 
using any classical strategy are independent. Since the 
code [[n, 1, d]]2 used is publicly known and all the qubits 
used to encode do not suffer from any quantum er- 
ror, any measurement of the (n — t) publicly available 
qubits taken from only reveals information on the 
sealed quantum state |^). Similarly, any measurement of 
the t qubits taken from jO)®,* only reveals information on 
the location and the nature of the "quantum error" by 
regarding the n publicly available qubits as a [[n, l,(i]]2 
codeword. 

Fourth, I show that the verification test put a strin- 
gent limit on the information obtained by any classical 
cheating strategy. Recall that only one qubit for each 
[[n',l,3]]2 encoded |0) are pubhcly accessible. Conse- 
quently, amongst the deterministic cheating strategies 
(8)"=! ^i-i "-"^^y those that cause no error in all the t qubits 
taken from 10}^/ can pass the verification test. So, in or- 
der to have at least ep chance of passing the verification 
test. Bob cannot put too much weight on those cheating 
strategies that cause error in these t qubits. Similarly, 
only those errors in the {n — t) qubits taken from 
that commute with the stabilizer of [[n, l,d]]2 can pass 
the test. Recall that operations commuting with the sta- 
bilizer of [[n, l,d]]2 are generated by the stabilizer and 
the encoded operations. Besides, an error in the stabi- 
lizer of a code simply permutes the stabilizer itself P]. 
Therefore, effectively the types of action on that 
can pass the verification test are those generated by the 
encoded operations of [[n, 1, d]]2- 

By the Holevo theorem 8], Bob's information /g on 
the locations of the t publicly accessible qubits that are 
not used to encode \'ip) is upper bounded by the entropy 
of the reduced density matrix of the n't qubits originally 
used to encode |0)®*. Therefore, le is upper bounded by 
the entropy of the reduced density matrix diag[a, (1 — 
a)/(2* - 1), (1 - a)/(2* - 1), . . . , (1 - a)/(2* - 1)]. In other 
words, 

h < -alog2a-(l-a)log2[(l-a)/(2*-l)] 
< H{a)+t{l-a), (1) 

where H{a) = — alogjO — (1 — a)log2(l — a) and a is 
the probability of choosing a deterministic strategy that 
causes no error in all the t qubits taken from 10)®*. 

If the strategy passes the verification test with proba- 
bility at least ep, we demand ep < a < 1. Provided that 
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Alice chooses a sufficiently long code [[n, l,d]]2 in such a 
way that t = [{d — 1)/2J satisfies 



ep >!/(! + 2*), 



(2) 



Bob's information on the locations of those t qubits in 
Eq. is upper bounded by 



le < H{ep) + (1 - ep)t = /bound(ep)- 



(3) 



Consequently, for any cheating strategy that passes the 
verification test with probability at least Cp, the loca- 
tions of at most /bound (cp) of out the t publicly accessible 
qubits taken from |0)®* are known to Bob. 

Finally, I am ready to bound the amount of informa- 
tion on the sealed quantum state revealed by a cheating 
strategy that passes through the verification test with 
probability at least Cp. But before I do so, let me sum- 
marize the situation after Bob passes the verification test. 
Bob knows the locations of at most /bound (cp) out of the 
n publicly accessible qubits that are not used to encode 
lip). Denote p the covering radius of the [[n, l,d]]2 quan- 
tum code. That is to say, p is the smallest integer such 
that F" equals the union of spheres of radius p centered 
at the vectors spanned by the stabilizers and encoded 
operations of the [[n, l,d\]2 CSS code over F4. In simple 
terms, p is nothing but the maximum number of errors 
the quantum code [[n, l,(i]]2 can handle. Thus, in or- 
der to recover the sealed quantum state \ip), Bob has to 
determine the locations of at least (n — p) out of the re- 
maining [n — /bound(ep)] qubits that are used to encode 
1^). More importantly, he has to do so in the presence of 
at least [t — /bound(ep)] qubits chosen from 10)^/ without 
affecting them. 

Since the locations of these [t — /bound (fp)] qubits are 
unknown to Bob, this problem is equivalent to picking 
(n — p) good balls out of an urn of [n — /bound(ep)] balls 
with [t ~ /bound (cp)] of them being bad. The probability 
of correctly picking the good balls is given by 



n—p—l 

n 

1=0 



(n — i — i) 



< 



n — t 



/bound (fp) 



n—p 



(4) 



The [[n, 1, d]]2 CSS code can be regarded as a classical 
{n, \[n + l]/2]) code over F4 nil. Applying the redun- 
dancy bound 9] to this classical code, I conclude that 



p < n 



'n + 1" 




n — 1 


2 




2 



(5) 



Recall that Bob may obtain some information on |?/;} 
only when he makes use of at least [n — p) out of the 
n publicly accessible qubits. Therefore, from Eqs. Q 



and jSj), Bob's information /|^^ on \tp) is upper bounded 

by 



/|V<) < 



n — t 



/bound (Cp) 



\(n+l)/2-\ 



(6) 



Remember that one can always choose t/n to be at 
least 0.5/^-1(1/2) « 0.055 0. Besides, Eq. @ im- 
plies that /bound(ep) increases linearly with t. Since 
/bound (cp) < t whenever Eq. ((SJ holds, I conclude that 
[n — t)/[n — /bound(ep)] is upper bounded by a positive 
number a{ep) < 1 for sufficiently large n. More im- 
portantly, a{ep) is independent of n. (Actually, a{0) < 
(1-0.055)7(1-1-0.055) < 0.896.) Therefore, by choosing 



n > 21og„(. ) I - 



(7) 



Bob's information on the sealed quantum state \tp) is less 
than ej. 

In conclusion, I show that for any security parameters 
(ep,e/), there is an unconditionally secure quantum seal 
with n satisfying Eqs. (0) and Q such that whenever Bob 
uses a cheating strategy that passes with probability at 
least ep, his information on the sealed quantum state [ip) 
is less than e/. 

Discussions — Three remarks are in place. First, al- 
though I focus the discussion on sealing a pure quantum 
state, the analysis above applies equally well to mixed 
state. Hence, the quantum sealing scheme reported here 
is also valid for sealing mixed state. 

Second, since the verification test is nothing but an 
error syndrome measurement procedure, the quantum 
sealing scheme works equally well if the encoded state 
0)®,* is replaced by (^-^i |'/'i)L' for some pure states 
(^-l,2,...,^). 

Third, all versions of quantum sealing schemes intro- 
duced in the Letter uses two stabilizer codes. It is more 
efficient to seal a quantum state by using just one stabi- 
lizer code. That is to say, one encodes the quantum state 
to be sealed by a [[n, l,d]]2 code and randomly replace 
t = l(d — 1)/2J qubits in the codeword by some randomly 
chosen pure states similar to the Bechmann-Pasquinucci 
scheme |l|. It is instructive to investigate the uncondi- 
tional security of this scheme by suitably bounding the 
information on the locations of the t replaced qubits. 
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